Use of uninitialized resource in wire - #VU164390

Vulnerability details

The vulnerability allows a remote attacker to crash the decoding process and potentially corrupt previously decoded, retained data.

The vulnerability exists due to use of uninitialized memory in Wire's Swift ProtoReader when a nested-message bounds check throws after the frame index advances but before initialization, causing cleanup to access an uninitialized frame. A remote attacker can supply protobuf bytes containing a truncated nested message to trigger a process crash even if decoding errors are caught, with retained-data corruption dependent on the allocator, schema, and application lifecycle.

Affected software

Remediation

External References

• https://github.com/square/wire/security/advisories/GHSA-f4vm-4gr7-vrcg

Related Security Bulletins

• Use of uninitialized resource in wire